Privacy Policy

1. Data we collect

• Account data: e-mail address, name, password (stored only as a hash), preferred language, recovery code (stored as a hash) and optional contact details such as a Telegram username if you link our notification bot.
• Project data: project name, website URL or Telegram bot username, display name shown to your customers, business category, expected volume, description and contact Telegram, plus review notes.
• Transaction data: invoices (amounts, currency, order ID and URLs you send us), selected asset and network, deposit addresses, transaction hashes, webhook delivery logs, balances, ledger entries and payout addresses.
• Support data: messages and attachments you send in support tickets or on Telegram.
• Technical data: IP address, browser and device information, login times and IP, security and audit logs, and the source of your visit (referrer, campaign parameters, country derived from the IP address).
• Checkout visitors: customers paying an invoice do not need an account. We process their IP address, browser information and the blockchain transaction they send; any order details come from the merchant.

2. Public blockchain data

Payments and payouts are recorded on public blockchains. Addresses, amounts and transaction hashes are visible to anyone and cannot be changed or deleted by us or anyone else.

3. Why we use your data

• to provide the service: accounts, project review, invoices, checkout, payment detection, webhooks, balances and payouts (performance of our contract with you);
• to keep the service secure and prevent fraud, abuse, money laundering and sanctions violations (legal obligations and our legitimate interests);
• to communicate with you: service e-mails and Telegram notifications about your account and projects, and occasional product e-mails that you can unsubscribe from at any time;
• to understand how our website is used and improve it (legitimate interests), and to attribute sign-ups to partners in our affiliate programme;
• to meet accounting, tax and legal obligations.

We do not sell your personal data and we do not use it for automated decisions that have legal effects on you.

4. Cookies and analytics

• Essential cookies: session and security (CSRF) cookies for the panel and checkout, and your language choice. They are needed for the service to work.
• Referral cookies: when you arrive through a partner or coupon link, cookies store the referral code so that the sign-up can be attributed to that partner in the Mist Network affiliate programme, and a cookie stores the source of your visit.
• Analytics: we use Google Analytics to measure visits in aggregate and Microsoft Clarity to understand how pages are used (clicks, scrolling). Clarity masks text in the merchant panel and on sensitive elements such as payment addresses and is not loaded on the API keys page. In the EEA, the UK and Switzerland Clarity runs without cookies.
• The checkout stores your light/dark theme choice in your browser's local storage.

You can block or delete cookies in your browser settings; the panel and checkout may not work without essential cookies.

5. Who we share data with

• the merchant whose invoice you pay (invoice status, amounts, network and transaction hash);
• service providers that process data on our behalf: hosting, e-mail delivery, bot protection (Cloudflare Turnstile), analytics (Google, Microsoft) and Telegram for notifications you enable;
• blockchain data and exchange-rate providers, which we query with public addresses and transaction hashes;
• Mist Network services, for single affiliate attribution and partner commissions;
• authorities, courts or other parties where required by law or to protect our rights and users.

Some providers may process data outside your country. Where required, we rely on appropriate safeguards for such transfers.

6. How long we keep data

We keep account and project data while your account is active. After it is closed, we keep transaction, ledger and related records for as long as accounting, tax and anti-money-laundering laws require, and delete or anonymise other data when it is no longer needed. Technical logs are kept for a limited period for security purposes.

7. Security

We use encrypted connections (HTTPS), hashed passwords and recovery codes, signed API requests and webhooks, restricted administrative access with two-factor authentication and audit logs. No system is perfectly secure, so please protect your own credentials as well.

8. Your rights

Depending on the law that applies to you, you may have the right to access, correct or delete your personal data, to restrict or object to certain processing, to data portability and to withdraw consent. Deletion may be limited where we must keep records by law. You can also complain to your local data protection authority.

To exercise your rights, contact us on Telegram at @mistnetwork or through a support ticket. We may need to verify your identity before acting on a request.

9. Children

mistKET is a service for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy. The date at the top shows the latest version; material changes will be announced in the panel or by e-mail.

11. Contact

Mist Network (mistket.com). Telegram: @mistnetwork. Merchants can also open a support ticket in the panel.